The ZKAS Quantum Resistance Upgrade

Removing elliptic-curve keys entirely.

Solana, Ethereum, Cardano, Monero, Zcash and Firo all protect coins with elliptic-curve keys, and every one of them puts a public key on chain: in the address, in the signature, or next to each private payment. Today, working back from a public key to the secret key would take longer than the age of the universe. A large quantum computer does it in hours.

The upgrade takes public keys off the chain completely. Coins belong to an owner tag, a fingerprint made by hashing your secret keys. To spend, your wallet proves it knows the secrets behind the tag with a hash-based proof. There is no signature and no public key, so there is nothing on chain to work backwards from.

Why hashes beat curves: a quantum computer doesn't weaken elliptic curves, it solves them outright. Against a hash it can only guess faster, which at most halves its strength. A 512-bit hash still has over 170 bits of strength left; a 256-bit curve key has none.

Scroll to send the quantum wave through.

Zero public keys on chain.

Owning: your coins belong to an owner tag, a hash of your secret keys. Spending means proving you know those secrets with a hash-based proof. No signature, no public key.

Getting paid: you give the payer a payment code directly, by QR code or link. It never goes on chain. Their wallet uses it to seal the payment with a symmetric key.

On chain: only fingerprints, spent markers, sealed notes, the fee and a hash-based proof. A quantum computer needs a public key to start from, and there isn't one. Hashes can't be run backwards, even by a quantum computer.

A quantum computer could open private payments made today. Not ZKAS's.

Everything on a blockchain is public and permanent. Monero and Zcash lock each private payment with an elliptic-curve key exchange and write the exchange's public key right next to it, so the recipient can find it. Anyone can save those payments today and open them once a quantum computer exists, years after they were made.

The upgrade moves that step off the chain. The person being paid hands the payer a payment code directly, by QR code or link. The payer's wallet uses it to seal the payment with a symmetric key that never touches the blockchain. On chain there are only fingerprints, spent markers, sealed notes, the fee and a hash-based proof: no public key to start from, so nothing to open. The seal itself is 256-bit symmetric encryption, which a quantum computer can at most halve to 128 bits, still far beyond reach.

Recorded curve-locked payments: still sealed.

Checking every hash proof, pruning it, and leaving a fingerprint that proves it was protected.

Every node checks each hash proof once, when it arrives. After 7 hours the proof itself is pruned, but its result stays behind as a fingerprint in the block, sealed under proof of work. Storage stays flat, and the fingerprint is permanent evidence the payment was checked. A chain that keeps everything piles every proof up forever.

Proof storage at full load, after 0 years.

ZKAS proofs sit outside the block hash, so pruning them breaks nothing.

A block's fingerprint, its hash, covers the payments but never the proof that checked them. Once every node has checked a proof, it can be thrown away and the chain stays exactly as valid as before. Other privacy coins seal their proofs into the fingerprint, so they can never fully let them go.

A fresh block, with its proof attached.

ZKAS nodes start from a recent checkpoint instead of re-checking every old proof.

A new node on most chains downloads every block since the beginning and re-checks every proof inside it. A ZKAS node jumps to a recent checkpoint, the pruning point, whose private state is locked in by proof of work, and continues from there.

Nothing is lost: archive nodes can still replay the entire private history back to the first block and confirm it matches. We just did this on mainnet: 3,242,567 blocks and 13,960,587 private notes, an exact match.

ZKAS payments settle behind 600 blocks in 10 minutes.

Every block added on top of a payment makes it harder to undo. ZKAS adds a block every second, so a payment shows up in a second or two and has 600 blocks of proof of work behind it in about ten minutes. A chain with 10-minute blocks would have one.

Proof of work can't stop a forged payment. Only the maths inside the payment can.

Monero and Zcash use proof of work too. But proof of work only decides which payments come first. Whether a private payment is genuine is decided by elliptic-curve maths: the keys and proofs inside it.

So a quantum attacker never has to out-mine anyone. They forge a private payment that every node accepts as genuine, spending coins that aren't theirs or creating coins from nothing, and proof of work buries it under block after block like any honest payment.

In ZKAS, every private payment that proof of work buries has been checked with hash maths only, the same kind of maths proof of work itself runs on. There is no weaker layer underneath for an attacker to go around: hashes are something a quantum computer can only chip away at, never break.

Two proof-of-work chains, before a quantum attacker.